Active Exploitation of CVE-2026-90436 in Apache Axis 1.x Confirmed

www.acn.gov.it

Active Exploitation of CVE-2026-90436 in Apache Axis 1.x Confirmed

First seen 14 Nov 2026, 06:18 UTC • •72.6

Article Content

1 / 3

Browse articles

ThreatCluster •November 14, 2026 at 06:19 UTC

•CVE-2026-90436 is actively exploited, allowing remote code execution.
•All versions of Apache Axis 1.x are vulnerable, with no vendor updates available.
•Migration to supported alternatives is strongly recommended due to end-of-life status.

CSIRT Italia has reported active exploitation of CVE-2026-90436 in Apache Axis 1.x, a vulnerability with a CVSS score of 9.8. This flaw allows unauthenticated remote attackers to execute arbitrary code via unsafe deserialization of incoming SOAP messages. A proof-of-concept (PoC) code for the exploit was made public on November 10, 2026. All versions of Apache Axis 1.x are affected, and the vendor will not issue any updates due to the product's end-of-life status. The recommended mitigation is to migrate to a supported alternative like Apache Axis 2. The exact number of affected systems and details on the exploitation method remain unclear.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 10h ago How this analysis works

Timeline

2026-11-06

CVE-2026-90436 published

CVE-2026-90436 was officially published, highlighting a critical vulnerability in Apache Axis 1.x.

2026-11-10

First public PoC released

A proof-of-concept code for exploiting CVE-2026-90436 was made publicly available.

2026-11-13

Active exploitation reported

CSIRT Italia confirmed active exploitation of CVE-2026-90436 in the wild.

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Remote Code Execution
Zero-day Exploit

Vulnerability (1)

CVE-2026-90436

Weakness (1)

CWE-502 - Deserialization Of Untrusted Data

Affected Platform (1)

Apache Axis 2

Tool (1)

Apache Axis

Relationships

Apache Axis exploits CVE-2026-90436
CVE-2026-90436 targets Apache Axis 2
Remote Code Execution targets Apache Axis 2
Zero-day Exploit targets Apache Axis 2
CVE-2026-90436 related to CWE-502 - Deserialization Of Untrusted Data

Following this threat?

Track CVE-2026-90436 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What versions of Apache Axis are affected?

All versions of Apache Axis 1.x are affected by CVE-2026-90436.

Is there a patch available for this vulnerability?

No, the vendor will not release any updates as the product has reached its end-of-life.

What should organizations do to mitigate this risk?

Organizations should plan to migrate to a supported alternative like Apache Axis 2.

Continue Reading

Critical RCE Vulnerability in Confluence Data Center Disclosed Atlassian has disclosed a critical remote code execution vulnerability (CVE-2026-90436) affecting Confluence Data Center, which utilizes a vulnerable third-party library, Apache Axis. This vulnerability allows attackers to execute arbitrary code if the 'Remote API (XML-RPC & SOAP)' feature is enabled. The flaw has a…

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware Beginning on October 30, 2026, attackers exploited unpatched vulnerabilities in Check Point Security Gateways, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) and a local privilege escalation vulnerability (CVE-2026-123039). The initial wave targeted Israeli organizations, leading to root access…